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Abstract 

We construct a quantum bit commitment scheme using a double-slit setup similar to Wheeler’s 
delayed choice experiment. Bob sends photons toward the double-slit, and Alice commits by de¬ 
termining either the slit from which each photon emerges (for 6 = 0), or its landing position on a 
screen (for 6=1). Since the photon’s wave front expands at the speed of light, Alice cannot delay 
the detection indefinitely, or it would very soon be out of her control no matter how much resources 
she has. 
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Quantum bit commitment is an important cryptographic primitive because because it 
can be used as a building block of other more complex cryptographic protocols [lJ-Q] - A 
bit commitment protocol involves two parties, Alice and Bob, who do not trust each other. 
Alice begins by committing to Bob a secret bit b e {0,1} that is to be revealed to him at 
some later time. In order to ensure Bob that she will keep her commitment, Alice provides 
Bob with a piece of evidence with which he can verify her honesty when she finally unveils 
the committed bit. A bit commitment protocol is secure if it satisfies the following two 
conditions. (1) Concealing: Bob gets no information about the value of b before Alice 
unveils it; (2) Binding: Alice cannot change b without Bob’s knowledge. (In general both 
conditions are satisfied only asymptotically as some security parameter N becomes large.) 
Furthermore, if the protocol remains secure even if Alice and Bob had capabilities limited 
only by the laws of nature, then it is said to be unconditionally secure. 

As is well known, classical protocols cannot be unconditionally secure because their secu¬ 
rity always depends on some unfounded assumptions. In a quantum bit commitment (QBC) 
protocol, Alice and Bob execute a series of quantum and classical operations during the 
commitment procedure, which finally results in a quantum state in Bob’s hand. If 




( 1 ) 


then the protocol is perfectly concealing, and Bob is not able to extract any information 
about the value of b from pff. When Alice reveals the value of b, she must also provide 
additional information which, together with p^\ will allow Bob to check if she is honest. 


For some time a QBC protocol [9f proposed in 1993 was widely believed to be uncondi¬ 


tionally secure, but it was eventually shown otherwise 10]. Moreover, a “no-go theorem” 
was put forth in 1997 ll|,|l2], which supposedly proved that concealing protocols can always 


be cheated by Alice, consequently unconditionally secure QBC is ruled out as a matter of 
principle. Due to the importance of QBC, this result, if true, constitutes a major setback 
for quantum cryptography. 

Before proceeding further, it is instructive to outline the impossibility proof for the per¬ 
fectly concealing case [ll, [dJ. The proof is based on the assumption that, by quantum 
entanglement, Alice and Bob can keep all undisclosed classical information undetermined 
and stored them at the quantum level. In other words, they can delay all prescribed mea¬ 
surements without consequences until it is required to disclose the outcomes. It then follows 
that at the end of the commitment phase, there always exists a pure state in the joint 

Hilbert space Ha <S> Hb of Alice and Bob. |\P^) is called a quantum purification of the 
evidence state p'^ , such that 

( 2 ) 


Tr.l = pS, 
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where the trace is over Alice’s share of the state. Note that whether Bob purifies or not is 
irrelevant to Alice, and she could simply assume he does. In general purification requires 
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access to quantum computers, which is consistent with the assumption that Alice and Bob 
have unlimited computational power. 

Since the protocol is assumed to be perfectly concealing, therefore Eq. ([I]) holds. Then, 
according to a theorem by Hughston et al. [3], the two purifications |T^) and are 

related by a local unitary transformation Ua on Alice’s side, namely, 

l Ah = (3) 


Since Ua acts on Ha only, she can implement it without Bob’s help. Then it is obvious that 
Alice can change her commitment at will, and Bob will always conclude that she is honest 
because his density matrix p'^ is not affected by Ua- So it seems that no QBC protocols 
could be simultaneously concealing and binding. 

It has been shown that, if we do not adhere to the standard cryptographic scenario and 
allow Alice and Bob to control two separated sites each, then an unconditionally secure 
classical bit commitment protocol can be constructed using the fact that signal transmission 


speed is finite 
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In this paper, we are interested only in non-relativistic quantum bit 


commitment in the standard scenario where each party controls only one site. 

Since 1997, there have been many attempts at breaking the no-go theorem, however a 
mathematically rigorous result is still lacking so far. Conceptually, the claim that uncon¬ 
ditionally secure QBC is ruled out in principle is rather puzzling. First of all, while the 
objective of QBC is well defined, the corresponding procedure is not precisely specified. 
That is, there exists no general mathematical characterization of all imaginable QBC pro¬ 


tocols [14J. So it is unlikely that the no-go theorem could have covered all imaginable QBC 
protocols. Secondly, when something in nature is forbidden, there usually exists a deeper 
and more general reason or principle behind it. Thus, for example, electric charge can nei¬ 
ther be created nor destroyed because electromagnetic interactions obey an exact U( 1) gauge 
symmetry; arbitrary quantum states cannot be perfectly cloned because information cannot 
be transmitted faster than the speed of light; etc. However unconditionally secure QBC is 
not known to violate any laws in physics or information theory, so we believe that it is not 
strictly forbidden. 

Notice that the impossibility proof does not consider the time evolution of the wavefunc- 
tion involved. That is, the no-go theorem considers only stationary states with trivial time 
evolution properties which can be ignored. However a complete impossibility proof should 
also take into account the possible non-trivial time evolution of the quantum states involved. 
In this work, instead of stationary states such as ordinary qubits, we shall use photons whose 
spatial wavefunctions expand at the speed of light. We present below a practical protocol 
to illustrate our idea. The required experimental setup is a double-slit apparatus similar to 
Wheeler’s delayed choice experiment, which is readily implementable. 


Commit: 
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1. Bob sends an unpolarized photon toward a double-slit. With equal probability (1/3), 
the slits may be both open, or only one of which is open, or both closed. Alice is 
situated at a distance L from the slits. She can detect the photon either on a screen or 
using telescopes focused on the slits. The photon enters the slits at t — to, and reaches 
Alice at t — ti. 

2. To commit to b — 0, Alice uses the telescopes to determine the slit from which the 
photon emerges. For 6 = 1, she detects the photon on the screen and records its 
landing position. Alice must announce whether a photon has been detected or not. 

3. The above procedure is repeated N times. 

Unveil: 

1. At time t — T, Alice unveils the value of b and the corresponding detection data. 
Specifically, for 6 = 0, she must specify the slit from which each of the photons went 
through; for 6 = 1, she must reveal the position at which each photon landed on the 
screen. 

2. Bob checks if Alice’s data are consistent with her commitment. 

We now proceed to show that this protocol is secure, ft is obviously concealing, since 
the only information disclosed by Alice during the commitment procedure is if photons have 
been detected. 

Next we show that it is binding. First of all, Alice must specify if a photon has reached 
her site, so she must try to detect it in one way or another. If so, it is clear that she can 
no longer change her commitment safely. If Alice determines the which-slit information, 
then she would not be able to distinguish the single-slit events from the double-slit ones, so 
that consistent reconstruction of the interference pattern on the screen would be impossible. 
On the other hand, if she detects the photons on the screen, the resulting pattern is a 
superposition of single-slit and double-slit events, and it is again impossible to separate the 
two because they occur randomly. Hence Alice cannot commit to one bit value and unveil 
another. If she did, she could only do so by pure guessing, but then her success probability 
(P) is only of order 

P ~ 2~i N (4) 

which vanishes exponentially as iV —» oo. 

Finally we consider quantum cheating strategy. As we saw, Alice has to determine whether 
a photon has gone through the double-slit and announce the result to Bob. This is in principle 
not difficult if she honestly detects it using either the screen or the telescopes. If she did, then 
clearly she cannot safely change her commitment later on, as explained earlier. Therefore, 
in order to be able to cheat later, Alice must detect the presence of the photon without 
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disturbing its spatial wavefunction, which is however conceptually not possible because an 
unpolarized photon has no quantum properties other than its spatial wavefunction. 

Even if Alice could somehow solve the detection problem, there is another insurmountable 
difficulty which we discuss below. Let \'tpAB,ti) be the wavefunction of the photon when it 
reaches Alice. It is not known how, but for the sake of discussion, let us suppose that 
Alice can somehow commit coherently to b = 0, such that the resultant pure state can be 
schematically written as \^ab{x, tf)) = Af o |0)|V ; un(-L H))- where M 0 is a unitary operator 
representing Alice’s commitment action, and \<f>) stands for Alice’s ancilla state. At t — T, 
when Alice is supposed to unveil, the total wavefunction becomes 

\^ab(x,T)) =U(T,t 1 )M 0 \<l>)\il> A B(x,t 0 )). (5) 

where U(T,ti) = e - lH p ( T ~ t 0 i s the time evolution operator, and H p is the Hamiltonian of 
the photon. Note that without loss of generality we have ignored the time evolution of the 
ancilla state | <f>). 

Now, in accordance with the no-go theorem, if at time T Alice wants to safely change 
to b = 1, she can apply a cheating unitary transformation Ua on |\I/ab(x, T)). However in 
the present case it is not possible to implement Ua because the photon wave front grows at 
the speed of light and its size becomes astronomical within a short time. For example, even 
for a very modest commitment time of St — T — t\ — 1 second, the extent of the photon 
wavefunction is already many times the diameter of the earth. Theoretically Alice could still 
manipulate the wavefunction \^> ab(x,T)) if she had big enough instruments, but then she 
would not be able to do it in the privacy of her laboratory, and it would be no secret that she 
is cheating. The above arguments show that Alice cannot cheat unless she could somehow 
stop the time evolution of the wavefunction £)), which is however not allowed by 

nature. Hence we conclude that this protocol is binding as well as concealing. 

In summary, using a double-slit setup similar to Wheeler’s delayed choice experiment, we 
have constructed a QBC protocol which is readily implementable. This protocol is secure 
because (l)It is not possible to detect the existence of an unpolarized photon without dis¬ 
turbing its spatial wavefunction; and (2)It is not possible to stop the time evolution of a 
photon wavefunction after emerging from the double-slit. Our result shows that non-trival 
time evolution of quantum states can be used to guarantee the security of QBC. 
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